Analysis

  • max time kernel
    47s
  • max time network
    76s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 15:39 UTC

General

  • Target

    e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe

  • Size

    80KB

  • MD5

    35e7e6980c5409ffcf9d5abee90dd52f

  • SHA1

    6dfe037cb602faf01d0da4b8bc86b8d371f4ee4f

  • SHA256

    e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db

  • SHA512

    dc3aed042b1e37ac9d6948df75b988344995e09052c906cf7593fcb14780f03412fb1928ccc77aa92881220528a62abbb40d914bb0b262127118d2a24269d2e4

  • SSDEEP

    1536:0Fz0LnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMT:0Fz90hq+Yc7Hf4oa5r5sojsj+oMT

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
    "C:\Users\Admin\AppData\Local\Temp\e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\SysWOW64\net.exe
      net start "Task Scheduler"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 start "Task Scheduler"
        3⤵
          PID:1180

    Network

    • flag-unknown
      DNS
      zeyuansm.vicp.cc
      e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
      Remote address:
      8.8.8.8:53
      Request
      zeyuansm.vicp.cc
      IN A
      Response
      zeyuansm.vicp.cc
      IN A
      0.0.0.0
    No results found
    • 8.8.8.8:53
      zeyuansm.vicp.cc
      dns
      e8133cb910d7942b3e41d86fde02e860aa8f19a61ad99d2b390202fee14f20db.exe
      62 B
      78 B
      1
      1

      DNS Request

      zeyuansm.vicp.cc

      DNS Response

      0.0.0.0

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1716-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

      Filesize

      8KB

    • memory/1716-55-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/1716-57-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/1716-59-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    • memory/1716-62-0x0000000010000000-0x0000000010046000-memory.dmp

      Filesize

      280KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.